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^ . Abstract 
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. This paper considers the following problem. Two mixed-state quantum circuits Qq and Qi 

are given, and the goal is to determine which of two possibilities holds: (i) Qq and Qi act 
, nearly identically on all possible quantum state inputs, or (ii) there exists some input state p 

that Qq and Qi transform into almost perfectly distinguishable outputs. This problem may be 
viewed as an abstraction of the following problem: given two physical processes described by 
^ ' sequences of local interactions, are the processes effectively the same or are they different? We 

prove that this problem is a complete promise problem for the class QIP of problems having 
quantum interactive proof systems, and is therefore PSPACE-hard. This is in sharp contrast 
to the fact that the analogous problem for classical (probabilistic) circuits is in AM, and for 
' unitary quantum circuits is in QMA. 

o 

■ 1 Introduction 

o ■ 

I Randomness is a fundamental concept in complexity theory and cryptography that is sometimes 

' under-emphasized in the study quantum computing. For example, the most typically used quantum 

O . computational model is the unitary quantum circuit model restricted to pure quantum states; 

and although this model can simulate randomized computations, in some sense there is really 
no randomness at all in a unitary circuit computation. Indeed, in the framework of quantum 
information, pure states and unitary computations may be vievi^ed as being analogous to definite 
5^ i logical states and deterministic computations, with more general types of states and non-unitary 

operations being possible. In particular, quantum states may be mixed as opposed to pure, arising 
for example when a probability distribution over pure states is considered, and operations such as 
measurements and noise may be non-unitary but physically possible. 

A variant of the quantum circuit model allowing mixed states and non-unitary operations was 
introduced by Aharonov, Kitaev, and Nisan [1]. They showed that this more general model is in fact 
equivalent in power to the unitary quantum circuit model. The principle behind this equivalence is 
the fact that arbitrary physically realizable quantum operations, including irreversible deterministic 
computations, random coin-flips, measurements, noise, and so on, can be described by unitary 
operations acting on larger systems. 

However, while the two quantum circuit models are equivalent in computational power, it is 
a misconception that they are identical, and that there is no loss of generality in restricting ones 
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attention to fully reversible quantum computational models. Indeed, in some restricted settings 
the equivalence of the models breaks down. For instance, it is not known if unitary quantum 
computations can simulate classical randomized computations in bounded space. For quantum 
finite automata the situation is much more alarming. Here, unitarity imposes a restriction that 
provably weakens the model over the usual deterministic (but irreversible) model; and while a 
definition based on mixed-states gives a natural and more satisfying model that generalizes classical 
(deterministic and probabilistic) finite automata, the weaker and less motivated unitary model has 
received far more attention. 

In this paper we describe a different sense in which the mixed-state quantum circuit model 
differs significantly from the unitary quantum circuit model. Our interest is with the computational 
complexity of problems about quantum circuits, and in particular our focus is on the following 
problem. Assume two mixed-state quantum circuits Qq and Qi, which agree on the number of 
input qubits and on the number of outpTit qubits, are given. For any input state p, let Qo{p) and 
Qi{p) denote the mixed states obtained by running Qq and Qi, respectively, on input p. It is 
promised that either (i) Qo{p) and Qi{p) are almost identical for all states p, or (ii) there exists an 
input state p for which Qoip) and Qi{p) are very different, and the goal is to determine which of 
these possibilities holds. (A natural way to formalize the notions of Qo{p) and Qi{p) being "almost 
identical" and "very different" is discussed in the next section.) This problem is phrased as a 
promise problem because it would be artificially difficult if it were necessary to distinguish cases 
when the distances between Qo{p) and Qi{p) are close to some threshold. Even with such a promise, 
however, we show that this problem is PSPACE-hard. More specifically, we show that this problem 
is a complete promise problem for the class QIP of problems possessing quantum interactive proof 
systems. In contrast, the classical analogue of this problem, to distinguish between two probabilistic 
boolean circuits, is easily shown to be contained in the class AM, while the variant of the problem 
where Qo and Qi are unitary quantum circuits is contained in QMA [4]. According to our current 
state of knowledge this represents a significant difference in hardness, given that AM = PSPACE 
and QMA = PSPACE both seem unlikely. 

It is natural to attribute the apparent difference in hardness of the above problems to the pres- 
ence of both randomness and quantum computation in the mixed-state quantum circuits variant 
of the problem — removing either randomness (leaving a unitary model) or quantum computation 
(leaving a classical probabilistic model) results in a reduction in complexity. This example under- 
scores the distinction between unitary and mixed-state quantum models. 

The above problem is also interesting for the much different reason that it abstracts the following 
natural physical problem: given two physical processes, are they effectively the same or are they 
different? Under the assumption that the physical processes in question are described in terms of 
local interactions among particles that can implement qubits and simulate mixed-state quantum 
computations, it follows that even to solve this problem approximately is PSPACE-hard. 

Finally, we are hopeful that the completeness of the problem discussed in this paper may lead 
to new results on the structural properties of the class QIP. For example, it is currently known 
that PSPACE C QIP C EXP [7] , but no strong evidence has yet been provided that suggests either 
containment should be an equality or a proper containment. 

The rest of this paper is organized as follows. In Section 2 wc discuss relevant background on 
mixed-state quantum circuits and other aspects of quantum information, and in Section 3 we state 
and discuss the definition of the computational problem of distinguishing mixed-state quantum 
circuits being considered. The main hardness result is proved in Section 4. We conclude with 
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Figure 1: The unitary operation U simulates the admissible operation 
Section 5, which mentions some open questions relating to the topic of the paper. 

2 Preliminaries 

2.1 Admissible operations and mixed-state quantum circuits 

We begin by discussing admissible quantum operations together with the mixed-state quantum 
circuit model of Aharonov, Kitaev, and Nisan [1]. 

For positive integers k and /, consider the set of operations mapping fc-qubit states to /-qubit 
states that correspond to physically possible operations (in an idealized sense). Quantum infor- 
mation theory gives a simple description of this set of operations, sometimes called the set of 
admissible operations. Specifically, an operation $ from k qubits to / qubits is admissible if its 
action on density matrices is linear, trace-preserving, and completely positive. This means that if 
p is a density matrix on A;-|-m qubits for some arbitrary value of m, and $ is performed on the first 
k qubits of p, then the result is a valid density matrix on Z -|- m qubits. In symbols, ($ (g) Im){p) is a 
density matrix, where Im denotes the identity mapping on m qubit states. Examples of admissible 
operations include unitary operations (which require that k = I), irreversible classical computations 
from k bits to I bits, and the operations of adding qubits in some specified state and discarding 
qubits. 

A quantum gate of type {k, I) is a gate that takes k qubits as input and outputs I qubits, and 
corresponds to some admissible operation. Mixed-state quantum circuits are circuits that consist 
of some finite collection of such gates along with acyclic input/output relations among these gates. 
A given mixed-state quantum circuit will have some number n of input qubits and some number m 
of output qubits. Using the same terminology for circuits as for gates, we may say that a circuit is 
of type (n, m) when this is the case, and more generally we say that an operation is of type {n, m) if 
it maps n qubit states to m qubit states. Thus, a circuit Q of type (n, m) specifies some admissible 
operation of type {n,m), and when convenient we also let Q denote this admissible operation. 

A necessary and sufficient condition for an operation $ of type {k, I) to be admissible is that 
there exists a unitary operation U acting on k + 2l qubits such that the following holds. If the first 
k qubits are set to state p and the remaining 21 qubits are initialized to the |0) state, the operation 
U is applied, and finally the last k + I qubits are discarded (or traced out), the resulting state on 
the remaining I qubits is $(/?). This situation is illustrated in Figure 1. This fact is generally 
attributed to Choi [3], and a proof may be found in Kitaev, Shen, and Vyalyi [6]. This process 
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may be applied to each gate in a given circuit Q, resulting in a unitary circuit P that simulates Q 
in a sense similar to the situation pictured in Figure 1. Under the assumption that each gate is of 
constant size, the number of additional qubits required is linear in the number of gates of Q. 

For the remainder of this paper it will be assumed that all mixed-state quantum circuits under 
consideration are composed of gates from some reasonable finite set. In order to avoid a discussion 
of what exactly is meant by "reasonable" , let us for simplicity say that this means that if the gates 
are expressed as linear mappings, then these mappings can be written as matrices consisting of 
efficiently approximable numbers. The point is to disallow difficult to compute information from 
being somehow incorporated into the action of gates acting on a finite number of qubits. Assuming 
that such a finite set of quantum gates has been fixed, a quantum circuit may easily be described 
classically. It will not be necessary to discuss a particular method of encoding quantum circuits 
beyond stating the assumption that the encoding is efficient, reasonable, and disallows compact 
descriptions of large circuits. Given such a classical description of a circuit Q, it is possible to 
compute in polynomial time a description of a unitary quantum circuit P that simulates Q in the 
sense described above. 

A few additional requirements on the set of gates of which mixed-state quantum circuits may 
be composed is required for the hardness results proved in this paper. The requirements are that 
(i) the set of gates is Tiniversal for quantum computation, meaning that any constant-size unitary 
operation can be efficiently approximated by circuits composed of these gates, (ii) the gates include 
a gate of type (0, 1) that introduces a qubit initialized to the state |0), and (iii) the gates include 
the unique gate of type (1,0) that corresponds to discarding a qubit. 

2.2 Distance measures for quantum states and admissible operations 

The problem of distinguishing quantum circuits on which this paper focuses requires a notion of 
distance between admissible operations. The notion we will use, and which we claim is the most 
natural with respect to the problem, is given by a norm known as the diamond norm. 

Before discussing the diamond norm, we need to mention the trace norm, which induces a 
distance measure between density matrices that is analogous to the distance between probability 
distributions induced by the 1-norm. For a given square matrix X, the trace norm of X, denoted 
||X||tr, is defined to be the sum of the singular values of X. In case X is Hermitian, is also 

equal to the sum of the absolute value of the eigenvalues of X. Equivalent expressions for the trace 
norm (for general X) include ||X||tr = ti^fxJx and ||X||tr = max{| tr(XC/")|}, where the maximum 
is over all unitary U having the same dimensions as X. 

The quantity ||po — Pilltr given density matrices po and p\ has the following operational 
interpretation. Given any binary-valued measurement, let us say that the measurement is correct 
in the event that, on input pi,, the outcome of the measurement is 6, and is incorrect when the 
outcome is Assuming po and pi are each given with probability 1/2, the quantity ||po ~ Pi Iltr 
represents the maximum over all possible measurements that the measurement is correct minus 
the probability the measurement is incorrect. Thus, ||po — Pilltr — ^ implies that po and pi are 
perfectly distinguishable by some measurement, while ||po ^ Pi Iltr ~ example, implies that 

the maximum probability of correctness for any measurement given po and pi uniformly is 3/4. 
Obviously ||po — pi||^j, = implies po = pi, and so no measurement can do better than random 
guessing in this case. 

The trace norm may be extended to differences in admissible operations in the following standard 
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way: if $ and * are admissible, then 

||$-*||,,'i'max{||<I>(X)-M/(X)||,, : = 1}. 

Unfortunately this norm has some unusual properties that make it unsuitable for describing dis- 
tances between admissible operations. One problem is that the maximum may not be achieved 
when X is a density matrix, and another is that the value of the norm may change if $ and * are 

tensored with the identity operation on some number of qubits. 

With this in mind, one defines the diamond norm of the difference $ — for $ and ^ admissible 
operations of type (n,m), as follows: 

II $ - \l "^^^^ II $ ® /„ - * ® /„ II,, = max{ II (# ® In){X) - (* ® /„) (X) II,, : II X II,, = 1}. 

Here, /„ denotes the identity operation on states of n qubits and the maximum is over all 2^" x 2^" 
matrices X (with ||X||fi. = !)• The diamond norm was first defined and studied by Kitacv [5]. 
Further information on it may be found in Refs. [6] and [1]. The maximum in the above definition 
always occurs for X a density matrix (and therefore for X = |V')(V'| for some unit vector by a 
simple convexity argument), and the quantity does not grow if the identity is taken on more than 
n qubits. The second fact was already known but the first is new. A more technical discussion of 
these facts can be found below in Section 2.4. 

The diamond norm gives a similar characterization of the distinguishability of admissible opera- 
tions that the trace norm gives for states. Specifically, the diamond norm of the difference between 
two admissible operations characterizes the probability that the output of these two operations can 
be distinguished, given that an input to the two operations is chosen that maximizes the distin- 
guishability of the outputs. It is important to note that this includes the possibility that the input 
is a state of a larger system on which the operations act on only part. 

Another useful way to measure the similarity between density matrices is given by the fidelity. 
Specifically, the fidelity between density matrices p and ^ is defined as: 

The fidelity is a measure of similarity that is related to but different from the trace norm. Generally 
speaking, when two states are close together they have large fidelity and small trace norm, and 
when far apart have small fidelity and large trace norm. At first glance the fidelity appears to be 
an unusual and possibly difficult to use quantity, but in actuality it is often easier to use than the 
trace norm. (For instance, it is multiplicative with respect to tensor products.) For all density 
matrices p and it holds that 

i-^l|p-eiltr< Hp, < ]l^-\\\p-al- 

2.3 Quantum interactive proof systems 

Quantum interactive proof systems are interactive proof systems in which the prover and verifier 
may exchange and process quantum information [7, 12]. The class of problems having quantum 
interactive proof systems is denoted QIP and is known to satisfy PSPACE C QIP C EXP. 

The main result of this paper, stated more formally in the next section, establishes that the 
problem of distinguishing mixed-state quantum circuits is QlP-complete. This will be proved by 
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first noting that a fairly straightforward quantum interactive proof system exists for the problem, 
and second by reducing a problem that was already known to be complete for QIP to the circuit 
distinguishing problem. In fact, the problem we will use for the reduction was only implicitly proved 
to be complete for QIP in Ref . [7] , but all of the pieces needed to establish this fact are present in 
that paper. The problem is as follows. 

Problem (Close Images). This problem is parameterized by constants a, 6 G [0,1] with b < a. 
For such constants, define the promise problem C\a,b as follows: 

Input: Mixed state quantum circuits {Qo,Qi) of type {n,m). 

Yes: There exist n qubit states po and pi such that F{Qo{po),Qi{pi)) > a. 

No: For all n qubit states po and pi, F{Qo{po), Qi(pi)) < b. 

The "yes" instances of the problem are therefore circuits whose images are close with respect to 
fidelity, while the "no" instances are circuits whose images are far apart. Completeness of this 
promise problem for QIP holds for any constants a, b with < 6 < a < 1. 

2.4 More notation and technical facts concerning distance measures 

The proofs in the sections that follow will require more precise notation than has been necessary thus 
far, as well as a few key facts about the distance measures discussed previously. It is convenient 
to include these things at this point, but the reader uninterested in the technical details of the 
proofs may safely skip the remainder of this section. For the most part our notation is standard 
and consistent with Kitaev, Shen, and Vyalyi [6], which may be consulted for further background 
information. 

Hilbcrt spaces will be denoted by scripted letters, such as TC, /C, etc. It will always be the case 
in this paper that Hilbert spaces have a standard orthonormal basis that is in correspondence with 
binary strings of a given length. We write, for instance, TL = HiTi^) when the standard basis of H 
is in correspondence with S", for S = {0, 1}. For given Hilbert spaces H and /C, L(H,/C) denotes 
the set of linear operators from Ti to /C, and L('H) is shorthand for L('H, Ti). The set D('H) consists 
of all positive semidefinite operators on 7i having unit trace (i.e., all density matrices over 7i). 
The set U('H,/C) consists of all linear operators from Ti to K, that preserve the Euclidean norm. 
Equivalently, U^U = lu (the identity operator on Ti). In case dim(7^) = dim(/C), U(7^,/C) consists 
of those operators that are unitary, and we write U('H) as a shorthand for U(?Y,7Y). The set 
T{Ti.,IC) consists of the linear operators from L('H) to L(/C). Admissible operations are examples 
of such mappings, which in general will be called transformations. 

The partial trace is the admissible operation obtained by taking the tensor product of the trace 
with the identity, and corresponds to discarding part of a quantum system. One writes tr-^ to 
denote this operation when the trace is on the space TC. If X € L(H) is positive semidefinite and 

G W ® /C satisfies try^ (V'l = then \ip) is said to be a purification of X. Such a purification 
always exists provided dim(/C) > rank(X). The fidelity has an alternate characterization in terms 
of purifications that is important to a proof appearing later. 

Lemma 2.1. Let p,(, G D(W). Then for arbitrary purifications \i/j),\(f)) G T-L®K. of p and ^, 
respectively, we have ||tr-^ |V')(<?^I lltr ~ F{p,$,). 

Proof. Using one of the alternate characterizations of the trace-norm together with Uhlmann's 
Theorem and a well known fact about the unitary equivalence of purifications of a given state, we 
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have 



|trH|V)(</'||ltr = max |tr(trH|V)(<^|)t^| = ma^ |tr |V)(<^|(/h ® 

= max K</.|(/^®C/)|V')|=F(p,0 
c/eu(/c) 



as claimed. 



□ 



We now give a more general definition for the diamond norm, which is consistent with the 
definition given previously for differences of admissible transformations. 



Definition 2.2. If $ G T(W,/C) then 



l$l 



def 



tr 



where ^ is a Hilbert space with dim(^) = dim(7^). 

It is known (see Ref. [6]) that increasing the dimension of Q gives no increase in ||$ (g) Ii,{g) \\^^- 

Theorem 2.3 (Kitaev). Let $ G T{H,)C), and let he a space of arbitrary finite dimension. 
Then 



$ /t 



< ll^l 



'L{^)lltr 

The following fact shows that the maximum in Definition 2.2 occurs on a rank-one projection 
provided $ is the difference of two completely positive transformations. In particular this holds 
when $ is the difference of two admissible operations. 

Lemma 2.4. Let $ G T(K,/C) satisfy $ = $o — for $o o,nd $i completely positive. Then there 
exists a Hilbert space T and a unit vector |^) T such that 

II^L = ||(^<^^L(^))(IV')(V'l)||t,- 

Proof. Let ^ be a Hilbert space with dim^ = dimH. Then 



$ O It 



max{||($0/L(g))(X)| 



1^1 



tr 



!}• 



L{e)|ltr ^W-^- - '^Ky)'^-' ' Wtr 

Let X € L('H (g) F) satisfy this maximum, let A = A{Tj) be a Hilbert space corresponding to a 
single qubit, and let y G L('H (g .F (g ^) be defined as 

r = ^x®|o)(i| + ^xt®|i)(o|. 

We have \\Y\\^^ = \\X\\^^ = 1 and y = yt. 

The condition that ^> = $o ~ for $o and $i completely positive implies = for 

every X G L(?-^). (In fact, the two conditions are equivalent.) Defining = ^ (g ^, we therefore 
have that 



|($0/L(^))(y)||^^ 



($ W ® |0)(1| + ($ ® ® |i)(o| 

1 



tr 



($<g/L(g))(X)||^^ + ^ ($0/L(g))(XT) 

($ ® /L(g))(^) II,, + I II ((^ ® /l(0))(X))^ 



tr 



= ll^l 
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As Y is Hermitian, we may write 



Y = ^X^\i;i){i;^\, 

i 

where is an orthonormal set of eigenvectors of Y with real eigenvalues {Aj}. As ||5^||t;j. = 1, 

we have J2i = 1- Now, 

II ® II,, < 5^ I A, I II ($ c5 iu^))mm I, , 

i 

and because Yli | Aj | = 1 we have 

\\{^®hi:F))mmi,>mo 

for some i. Let \ip) = {ipi) for some value of i for which this inequality is satisfied. Because 
\\{^(^lMT)){mm\l, < IMo by Theorem 2.3, we have || ||,, = IMo as 
required. □ 

Strangely, this fact does not hold in general for the trace norm \\^\\^,. in place of the diamond norm. 



3 The quantum circuit distinguishability problem 

The problem of distinguishing the actions of two circuits is an interesting problem from a complexity 
theoretic standpoint. The problem of distinguishing two classical circuits that do not make use of 
randomness is in NP, as one can easily verify that two circuits have different outputs given an 
input on which they differ. If the circuits use randomness they can be distinguished in AM by 
a fairly straightforward protocol. If we change the model to quantum circuits over pure states, 
which capture the intuitive notion of deterministic computation using quantum information, the 
complexity of the circuit distinguishability problem is in QMA (which is essentially a quantum 
version of NP) as shown by Janzing, Wocjan, and Beth [4]. If we combine these models, moving 
to mixed state quantum circuits, where non-unitaxy operations such as measurement can add 
randomness, we see what appears to be a significant increase in the complexity of the problem. 
The definition of the problem follows. 

Problem (Quantum Circuit Distinguishability). The problem is parameterized by constants 

a,b € [0, 2] with b < a. For such constants, define a promise problem QCD^ as follows: 

Input: Mixed-state quantum circuits {Qo,Qi), both of the same type {n,m). 
Yes: WQo - Qi \\^ > a 
No: ||Qo-Qi|U<^ 

One may also consider the case where a and b are functions depending on the input length, but 
this paper will focus on the case where a and b are constant. 

At first glance this problem appears to be similar to the C\a,b problem of the previous section, 
but we claim that the relation is not at all obvious. We feel the QCD problem is a more interesting 
problem, particularly because it abstracts a natural physical problem and reveals an apparent 
complexity-theoretic difference between pure and mixed state models as was discussed previously. 
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In contrast, the CI problem is really just a rephrasing, based on a theorem in quantum information 
theory known as Uhlmann's Theorem, of the problem that asks whether a given three-message 
quantum interactive proof system can be made to accept with high probability. 

We now observe that QCD^ G QIP provided a and b are constants with b < a. (For variable a 
and b, this fact holds if a and b are polynomial-time computable and are separated by the reciprocal 
of some polynomial.) A simple proof system for this problem is based on the "blind taste-test" 
idea that is frequently used in the study of interactive proofs. Specifically, a prover attempting to 
prove that circuits Qo and Qi differ prepares a state p on which they differ and sends the part of p 
on which the circuits act to the verifier. The verifier applies either Qo or Qi randomly, sends the 
output to the prover, and challenges the prover to identify which circuit was applied. 

Theorem 3.1. QCD^ 5 G QIP for any constants a and b with < b < a < 2. 

The proof is based on the following protocol. 

Protocol 3.2 (Quantum Circuit Distinguishability). Input to both P and V is {Qo,Qi), 
where circuits Qo and Qi are assumed to both be of type {n, m). 

1. V receives from P an n-qubit quantum register X. 

2. V selects i G {0, 1} uniformly and applies circuit Qi to X. The result is an m-qubit register Y, 
which V sends to P. 

3. V receives from P some j € {0, 1}, and accepts ii i = j, rejecting otherwise. 

Proof of Theorem 3.1. We will show that the verifier described in Protocol 3.2 admits a quantum 
interactive proof system for QCDa ;, with acceptance probability at least ^ -|- | on yes instances 
and acceptance probability at most ^ -|- | on no instances. It suffices to prove that the maximum 
probability with which a prover can cause the verifier described in Protocol 3.2 to accept is ^ -|- 

I IIQo - Qillo- 

Let H be the Hilbert space corresponding to the input qubits of Qq and Qi, and let /C be the 
Hilbert space corresponding to the output qubits. By Lemma 2.4 there exists a Hilbert space Q and 

a unit vector IV') G such that ||Qo -QilU = || (Qo ® 4(g))(|V')(V'l) - (Qi 

Fix such a and define po = (Qo<8)-fL{g))(|^)(^|) and pi = (Qi ® /L(g))(|V')('0l)- Now, let Ho and 
Hi = /— Ho be projection operators on IC<SiG that specify an optimal projective measurement for dis- 
tinguishing Po from pi. Such a measurement satisfies tr no(po~Pi) = tr ni(/9i — po) = ^\\pQ — pi 
Now, a strategy for the prover that convinces the verifier to accept with probability \\Qo ~ Qi |lo 
is as follows. The prover prepares two registers (X, Z) in state \ip) and sends X to the verifier. Upon 
receiving Y from the verifier, the prover measures (Y, Z) with the measurement {Ho, Hi} and re- 
turns the result to the verifier. It is a simple calcTilation to show that this measurement correctly 
determines i with probability ^ -|- | ||po — Pilltr = ^ + i IIQo — Qi|lo- 

The probability of acceptance attained by the above prover strategy is optimal, which may be 
argued as follows. Let ^ denote the mixed state of the register X together with any private qubits 
of the prover, which we represent as a register Z, immediately after the first message is sent. As 
before, we let Q denote the Hilbert space corresponding to the prover's private qubit register Z. 
The verifier applies cither Qq or Qi, which causes the pair (Y, Z) to be in state (Qo <Ei I'L(g))iO 
with probability 1/2 and (Qi <X'/L(g))(0 with probability 1/2. The register Y is sent to the prover. 
The prover's final message to the verifier is measured by the verifier, resulting in a single bit. This 
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process may be viewed as a binary valued measurement of registers (Y, Z). The probability that 
this measurement is correct is bounded above by 

l + \\\iQo^ lusM) - (Qi ® ^hgM) lltr <l + i\\Qo-Qi L 

as required. □ 

Note that a simple variant of the protocol described above gives an ordinary interactive proof 
system for the classical probabilistic version of the Circuit Distinguishability problem. As the 
proof system uses a constant number of messages, this demonstrates that the classical variant of 
the problem is contained in AM. 

4 QlP-hardness of distinguishing quantum circuits 

In this section we prove that QCD^ is hard, with respect to Karp reductions, for the class QIP for 
any choice of constants a and b with < 6 < a < 2. 

Theorem 4.1. QCD2_£,e is QlP-complete for every e > 0. 

This theorem is proved in two stages. First, the Close Images problem (for some appropriate choice 
of parameters) is reduced to QCD^ 1/4, implying QlP-hardness of QCD^ 1/4. Then, it is argued that 
QCDi 1/4 reduces to QCD2-£,e for any constant e > 0, which is sufficient to establish the main result. 
In fact, QCD2-£,e remains QlP-hard even when e is not constant, but rather is an exponentially 
small function of the input size. 

4.1 Overview of proof 

The input to the CI problem is a description of two circuits Qq and Qi, both of type (n,m) for 
nonnegative integers n and m. The reduction will transform the description of these two circuits 
into a description of two circuits {Rq, Ri) that form an input to the QCD problem. 

As discussed in Section 2.1 we may convert Qq and Qi into unitary circuits Pq and Pi, acting 
on n + k = m + l qubits, that simulate Qo and Qi. Here, k is the number of initialized qubits 
introduced into the circuit and I is the number of "garbage" qubits that are discarded at the end 
of the simulation. The assumption that Pq cind Pi act on the same number of qubits can be made 
without loss of generality, as additional dummy qubits could be added to either circuit as necessary. 
Given descriptions of Pq and Pi it is possible to efficiently construct a unitary circuit P that acts 
on one more qubit than Pq and Pi , and uses this additional qubit as a control to determine which of 
the two circuits Pq or Pi to perform. In other words, P(|0)|V')) = |0)Po|V') and P(|1)|V')) = |l)^'i|V') 
for any \tp). 

Next, define D(a) = |0)(0|c7|0)(0| + |l)(l|c7|l)(l|. This is an admissible operation on a single 
qubit that represents the process known as decoherence. Informally, the qubit is measured in 
the standard basis and the result is forgotten. If this gate is not included in the choice of basis 
gates, it can easily be constructed from gates in any basis satisfying the requirements discussed in 
Section 2.1. 

Finally, let Rq and Pi be circuits constructed from P and D as described in Figure 2. Here, the 
input qubits to Rq and Pi correspond to the input qubits of Qo or Qi, which P simulates, as well 
as the control qubit of P. The remaining k qubits are initialized to the zero state, which is required 
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D 



traced 
out 



Circuit Rq. 



] traced 
out 



Circuit Ri. 



Figure 2: Circuits output by the reduction. 



for the correct functioning of P. The qubits that are output by P include the control qubit, the m 
qubits representing the output of Qo or Qi, and the I "garbage" qubits that are traced out when 
simulating Qq or Qi- The circuits Rq and Ri, however, reverse the roles of the output qubits and 
garbage qubits of P. Specifically, the garbage qubits of P together with the control qubit are the 
output qubits of Ro and Ri, while the qubits of P corresponding to the output of Qq or Qi are 
traced out by Rq and Ri. It is this reversal that is the key to the reduction. The circuits Ro and 
i?i differ only in that Ri includes the decoherence gate on the control qubit after P is performed 
while Rq does not. 

When either of the circuits Rq and Ri is given an input in which the control qubit is in a 
superposition of state and 1, possibly entangled with the other input qubits, in effect both of 
the circuits Qq and Qi are run. The idea of the reduction is that if the outputs of Qq and Qi are 
close on their respective inputs, then when run in superposition discarding these outputs will not 
destroy the coherence of the control qubit, and thus the outputs of Rq and Ri will differ significantly 
because of the action of the decoherence gate. If the outputs of Qo and Qi are distinguishable, 
however, discarding the output qubits of Qq or Qi is tantamount to decoherence of the control 
qubit, and so there is no significant difference between Rq and Ri in this case as the decoherence 
gate is effectively redundant. 

Formalizing this argument and using suitable parameters allows us to conclude that QCDi 1/4 
is QlP-hard. Extending hardness to QCD2_£,£ can be accomplished by using a variant of Sahai and 
Vadhan's method of "polarizing" samplable distributions [10] applied to admissible transformations. 

4.2 Proof of Theorem 4.1 

This section contains a more formal proof that QCD2_£,£ is QlP-hard for any constant £ > 0, as 
described in the previous subsection. As QCD2_£,£ G QIP, this will imply Theorem 4.1. 

Let Qq and Qi be mixed-state circuits of type (n,m), and consider the circuit construction 
described in Section 4.1. To be more precise, let TC = TC{T,"') denote the space corresponding to 
the input qubits of Qq and Qi and let K, = /C(S™) denote the space corresponding to the output 
qubits of Qo and Qi. As discussed in Section 2.1, it is possible to efficiently construct unitary 
circuits Pq and Pi, acting on n + k = m + l qubits for some choice of k and /, that simulate Qq 
and Qi. Specifically, if £^ = and = J^i^}), then Pq and Pi induce unitary transformations 
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Uo, Ui G U(W ®£,1C®T) satisfying Qi{p) = tr^ U^{p ® |0'=)(0*^|)?7/ for i = 0, 1. 

Next, let A = be the space corresponding to a single qubit, and define a unitary operator 

U G U(^(g)7i(g)£:,^(g)/C(g)J") by the the equations U{\Q)\il})) = |0)C/o|V') and C/(|1)|V')) = |1) Ui\il)) 
for every IV') G (8i i^. It is possible to construct a unitary circuit P whose operation is described 
by U that has size polynomial in the sizes of Pq and Pi. Specifically, this may be done by replacing 
each gate of Pq and Pi by a similar gate that is appropriately controlled by the qubit corresponding 
to the space A and running the two circuits one after the other. The controlled gates are of constant 
size and may either be implemented directly or approximated with very high accuracy depending 
on the basis gates being considered. See Nielsen and Chuang [9, section 4.3] for further information 
on such constructions. We can assume without loss of generality that P acts on exactly those qubits 
Pq and Pi act on plus the control qubit; any ancilla required by P can be included in Pq and Pi. 

Finally, the circuits Rq and Ri described in Figure 2 correspond to admissible operations in the 
set T{A®'H,A® T), and can be described more precisely by 

Po(X) = tryc (P {X ® , RliX) = {D0 (tryc (p (x ® |0'=)(0'=|))) 

for every X G 'L{A'S>H). Here, the decoherence operation D is acting on A, i.e., D G T(^, ^). The 

space /C, which corresponds to the output qubits of Qo and Qi, is the space that is traced out by Rq 
and Pi , while the output qubits of Rq and Pi consist of the control qubit and the "garbage" qubits 
of Po and Pi, which correspond to T. Descriptions of these two new circuits can be computed in 
polynomial time given descriptions of Qo and Qi. 

The following lemma formalizes the intuition discussed previously that Rq and Pi act very 
differently if Qo and Qi can be made to have outputs that have high fidelity with one another. 

Lemma 4.2. ||Po - -Ri IU = max{P((5o(po), Qi(pi)) : po, Pi & 'D{H)}. 

Proof. Let po,pi G D(7Y) be any two states. We will show that ||Po — Pi||o > F{Qo{po),Qi{pi)). 
Define Wq, Wi G L('H,/C ^) as Wi = Ui{I-)-i (E> for i = 0,1, where Ui is the unitary operator 
corresponding to circuit Pj. Each Wi is a unitary embedding that effectively concatenates k ancilla 
qubits to a vector in H, and then performs Ui on the resulting vector. Let \ipo), IV'i) G H ^ be 
any purifications of po,pi, respectively, where Q is any Hilbert space large enough to admit such 
purifications. Let |^) = --i=|0)|V'o) + "^|l)|V'i) and consider the action of Pq and Pi on (where 
the circuits act trivially on the space Q). The circuits are identical aside from the decoherence gate. 
Immediately after the circuit P is performed but before the qubits corresponding to the space /C 
are traced out, the state obtained for both circuits will be |<^)(<?!>|, for 10) = -^210)100) + ^|l)|<;/!)i), 
where l^o) = (Wq (8) Ig)\'4>o) and \(f)i) = {Wi (g) ig)|^i). The output of circuit Pq can therefore be 
written as 

itr^(|O)(O|0|</.o)(</'o| + |O)(l|®|0o)(</'i| + |l)(0|®|<^i)(</.o| + |l)(l|$D|0i)(0i|) 
while the output of circuit Pi is 

^tryc(|O)(O|0|0o)(0o| + |1)(1|® |</.i)(</>i|). 

This is because the effect of the decoherence gate is to eliminate the cross-terms |0)(1| \4>o){<Pi\ 
and |1)(0| (g) |0i)(0o|- As \(po), € JC®J^®Q are purifications of Qq{pq) and Qi{pi), respectively, 
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we may conclude by Theorem 2.3 and Lemma 2.1 that 



\\Ro - Ri lU > \\{Ro /L(g))(l0)(0l) - {Ri ® lL(g)m{ML 

= ^ |||0)(1| ® trx; + |1)(0| ® tr^; |<^i)(<^o||ltr = 11*^^ l<^o)(</>i||ltr = ^(Qo(po), Qi(pi)). 

Next, by Lemma 2.4 we have \\Ro-Ri\\^ = ||(i?o » - (^i ® 
for some Hilbert space Q and unit vector e A 'Si H Q ■ As |^) is a unit vector we may 
write lip) = y/p\0)\ipQ) + Vl -^11)1-01) for {ipo) ^ H ® Q unit vectors and p G [0,1]. Let 
\(t>i) = {^i ® ^0)IV'i) and pj = trg for i = 0, 1. We have 

||(i?O®/L(0))(|^)(^|)-(i?l®/L(0))(|^)(^|)|L, 

= Vp(I-p) II |0) (1| ® tr^ |<^o) {<t>i I + |1) (0| ® trx; |0i) (</.o| ||tr 
= 2Vp(l-p)||tr^|</.o)(<^i|||t, 
< F(Qo(po),Qi(pi))- 

This completes the proof of the lemma. □ 

This lemma and the above construction imply that Cla^^ <m QCDa ;, for all a,b G [0,1] with 
b < a. As Cli is a complete promise problem for QIP and QCD^ is in QIP, we have that 
QCDi 1/4 is QlP-complete. 

Finally, we can extend the QlP-hardncss of QCD^ 1/4 to instances of the Quantum Circuit 
Distinguishability problem with a much stronger promise. This fact is based on a generalization 
of the "polarization" method developed by Sahai and Vadhan [10] in the context of statistical 
zero-knowledge . 

Theorem 4.3. Let a,b E (0,2) satisfy 2b < a?. There exists a deterministic, polynomial-time 
procedure that, when given as input {Rq, -Ri, 1"), where Rq and Ri are mixed-state quantum circuits, 
outputs quantum circuits {So,Si) such that 

1. \\Ra- Ri\\^<b ^ ll^o - Sill^ < 2-^*, anc( 

2. \\Ro-Ri\\^>a ^ ||So-5i||^ >2-2-". 

Sahai and Vadhan proved this theorem for polynomial-time samplable distributions, and it was 
observed in Ref. [11] that the theorem carries over to polynomial-time preparable quantum states. 
In the present case, the theorem must be extended to admissible operations. 

Lemma 4.4. //$i,$2 € T(7^,/C) satisfy ||$i — $2|U = ^' ^^^^ 

< ke. 



^ -fee 

2 - 2e~8- < 



Proof. Let .7^ be a Hilbert space of dimension equal to that of H, and let Y G L(H (8) J^) satisfy 
||($i ® 7l(^))(F) - ($2 (8 (1^)1 = 11^1 - ^2|U = 



|y||t, = 1 and 



13 



Then because = 1 we have 

II 1 1 tr 



*1 ^2 



> 



> 2 - 2e" 



The last inequahty follows from the result for states analogous to what is here being proved [11]. 
The second inequality will be proved by induction. The base case A; = 1 is trivial: 

ll^f -^f L = ii^i-^2iu = £. 

Assume then that k > I, and define ^'^ = for i e {1, 2}. We have 



1^1 



= 11*1 (g) - ^'2 ® $1 + *2 ® $1 - ^2 ® ^2|U 
< II (^-1 - *2) (E> "l-l lU + II *2 (^1 - ^2) L 
= II *1 - *2 lU II ^1 Wo + II *2 lU II ^1 - ^2 lU • 

Because the diamond norm of any admissible transformation is one (see [1] for a proof), we obtain 

11*1 - *2|U 11*1 llo + 11*2 L 11*1 - *2|U <{k-l)e + e = ke 

as required. □ 

Lemma 4.5. There is a deterministic polynomial-time procedure that, on input {Qo,Qi, y), where 
Qo,Qi are descriptions of mixed- state quantum circuits, produces as output descriptions of two 
quantum circuits, (i?o,-Ri) satisfying 

2-2exp(-^||Qo-Qi||') < \\Ro-Rih<r\\Qo-Qih. 

Proof. For i = 0,1, construct Ri by placing r copies of the circuit Qi in parallel. Then Ri = Qf'^, 
and the bounds on ||i?o — Ri IU follow from Lemma 4.4. □ 

Proposition 4.6. Let $o,*i e T{n,lC) and *o,*i e T{J^,g). Define 

1 1 

50 = -$o«)*o + 2*i<^*i' 

51 = ^$o«)*i + ^$o«)*i- 
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Then II So - Si || . = i || $0 - *i L • || *o - *i L- 
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Proof. Using Sq, Si as in the proposition, we have 



^11*0- 



^0 + ^$l 



$lll 



l*n - *i I 



1$0 i 

2 " 



^1 



as desired. 



□ 



Lemma 4.7. There is a deterministic polynomial-time procedure that, on input {Qq, Qi, V), where 
Qo,Qi are descriptions of mixed- state quantum circuits, produces as output descriptions of two 
quantum circuits {Ro,Ri) satisfying 



\Ro — Ri\ 



IQo — Qi I 



Proof The circuit Rq performs a transformation defined as 

1 



Rq 



2r-l 



E 



Q 



XI 



a;i,...,a;re{0,l} 
xi-\ \-XrSO (mod 2) 



while Ri performs a similar transformation defined as 

1 



Ri 



2r-l 



E 



XI 



' Qxr- 



a;i,...,3;re{0,l} 
xi-\ i-Xr=l (mod 2) 



These circuits are effectively running r copies of Qo and/or Qi in parallel, with the choice of Qo or 
Qi determined uniformly at random subject to the constraint that Rq applies an even number of 
copies of Qi while Ri applies an odd number. Such circuits may be constructed in time polynomial 
in the sizes of Qo and Qi. A proof by induction based on Proposition 4.6 establishes that Rq and 
Ri have the required property. □ 

Proof of Theorem 4-3. First, we apply the procedure given by Lemma 4.5 to {Qo, Qi, V), with 

r= [log(16n)/log(a2/(26))l , 

obtaining circuits {Qq,Q'i) satisfying 

\\Qo-QiL<b \\Q'o-Q[\l<2{b/2Y 
||Qo-QilU>« ^ ||<5o-Q'i|L>2(a/2f 

Next, we apply the procedure given by Lemma 4.7 to {Q'q, Q'l, V), where s = [(6/2)~''/4j , obtaining 
circuits {Qq,Qi) satisfying 



IIQo - Qillo < b 
\Qo- Qi \\c > a 



|Q'o'-Qi|L<2(V2r(V2)-74 = l/2 

\Qo - Q'iL > 2 - 2exp(-|(a/2)2-) > 2 - 2e-^^+\ 



15 



Finally, wc apply the construction of Lemma 4.5 once more, to (Qq, Q", 1*), where t = \{n + l)/2] , 
obtaining circuits {Ro,Ri) satisfying 

\\Qo-Qi\l<b => ||i?o-i?i|U<(l/2)^""^'^/'(l/2)("-')/' = 2-" 

II Qo -Qi\l>a ^ II Ro - Ri L > (2 - 26-^"+^) (1/2) r(»+i)/2l -i > 2 - 2-". 

The circuits {Ro,Ri) have size polynomial in r,s,t and the size of the original circuits {Qo,Qi)- 
Because r, s, t are bounded by polynomials in n, the size of the constructed circuits is polynomial 
in the size of the input. □ 

Theorem 4.3 implies that QCDi 1/4 <m QCD2-e,£ for every e > 0, which proves Theorem 4.1. 

5 Conclusion 

We have demonstrated that the problem of distinguishing mixed-state quantum circuits is a com- 
plete promise problem for the class QIP. Because QIP contains PSPACE, we conclude that this 
problem is PSPACE-hard, whereas its classical analogue is contained in the class AM and its unitary 
quantum circuit analogue is in QMA. 

Some open questions relating to this paper follow. 

• Does the QlP-completeness of the QCD problem shed any light on properties of QIP? For 
instance, is QIP is closed under complementation? Is QCD G PSPACE, which would imply 
QIP = PSPACE? 

• There are interesting questions and results relating to implementations of quantum computers 
that deal with unitary circuits with mixed-state inputs. (See, e.g., [2, 8].) Analogues of the QCD 
problem can be defined for this setting. For example, one might consider unitary circuits that 
act on some collection of inputs together with a collection of qubits in the totally mixed state. 
How hard is the QCD problem in this context? 

• Because it is not known whether QIP = PSPACE, the QCD problem is a candidate problem for 
QIP\PSPACE. Are there any reasonable non-promise problem candidates for problems in QIP 
but not in PSPACE? 
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